Consider sharing configuration files for ansible

[kmonticolo]

Consider decrypt and release vaulted configuration files for ansible. Thanks.

[mkuthan]

It's not easy; the Vault configuration contains a lot of sensitive data. I considered using defaults for all roles, but I abandoned that idea. From my perspective, it would result in boilerplate code that is hard to maintain and keep in sync with the Vault configuration. I would gladly accept suggestions on how to do it better :)

[kmonticolo]

That's right its actually not trivial. Something similar to this works quite well for me:

group_vars/
├── all/
│ ├── main.yml # non-encrypted config
│ ├── vault.yml # ENCRYPTED version of confidential values
│ └── vault.template.yml # TEMPLATE - explicit structure without data

vault.template.yml is a plain version of vault.yml, without any values, e.g.:
vault_db_password: ""
vault_api_token: ""
vault_admin_user: ""

and have vault includes in roles/tasks, e.g.:
vars_files:

• vault.yml

so the Pros are:

• vault.template.yml provides full documentation of expected variables — it can be tracked on GitHub.
• vault.yml stores only sensitive values.
• it is easy to check for missing variables — by comparing vault.yml ↔ vault.template.yml.
• versioning the structure does not cause leaks.
• CI/CD can use vault.template.yml for testing with dummy data.